2022 CVEs (page 30)
Page 30 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4900 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. |
CVE-2022-48461 | Medium | 4.4 | 2023-11-01 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-48460 | Medium | 5.5 | 2023-11-01 | In setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execu… |
CVE-2022-48459 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48458 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48457 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48456 | Medium | 4.4 | 2023-11-01 | In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution pri… |
CVE-2022-48455 | Medium | 5.5 | 2023-11-01 | In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution… |
CVE-2022-48454 | Medium | 5.5 | 2023-11-01 | In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution… |
CVE-2022-3007 | High | 8.1 | 2023-10-31 | The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used… |
CVE-2022-39172 | Medium | 5.4 | 2023-10-30 | A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacke… |
CVE-2022-20264 | Medium | 5.5 | 2023-10-30 | In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure… |
CVE-2022-4575 | Medium | 6.7 | 2023-10-30 | A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or l… |
CVE-2022-4574 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute… |
CVE-2022-4573 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbit… |
CVE-2022-48189 | Medium | 6.7 | 2023-10-30 | An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute a… |
CVE-2022-34834 | Medium | 4.8 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log. |
CVE-2022-34833 | Medium | 5.4 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component. |
CVE-2022-34832 | Medium | 6.5 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component. |
CVE-2022-3702 | Medium | 6.1 | 2023-10-27 | A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete c… |
CVE-2022-3701 | High | 7.8 | 2023-10-27 | A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to… |
CVE-2022-3700 | Medium | 6.1 | 2023-10-27 | A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a loca… |
CVE-2022-3681 | Medium | 6.5 | 2023-10-27 | A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully… |
CVE-2022-3611 | High | 7.6 | 2023-10-27 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive… |
CVE-2022-3429 | Medium | 6.5 | 2023-10-27 | A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering… |
CVE-2022-34887 | Medium | 4.3 | 2023-10-27 | Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the adm… |
CVE-2022-34886 | High | 8.8 | 2023-10-27 | A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to… |
CVE-2022-4886 | High | 8.8 | 2023-10-25 | Ingress-nginx `path` sanitization can be bypassed with `log_format` directive. |
CVE-2022-3699 | High | 7.8 | 2023-10-25 | A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 t… |
CVE-2022-3698 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-38485 | Medium | 6.5 | 2023-10-25 | A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authenticated attacker cou… |
CVE-2022-38484 | High | 8.8 | 2023-10-25 | An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to versi… |
CVE-2022-0353 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-22466 | Medium | 6.8 | 2023-10-23 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2022-4943 | High | 7.5 | 2023-10-20 | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin setting… |
CVE-2022-4290 | High | 8.8 | 2023-10-20 | The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 du… |
CVE-2022-3622 | Medium | 4.1 | 2023-10-20 | The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This mak… |
CVE-2022-3342 | High | 7.5 | 2023-10-20 | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' functio… |
CVE-2022-2441 | High | 8.8 | 2023-10-20 | The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This ma… |
CVE-2022-4954 | Medium | 5.5 | 2023-10-20 | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0… |
CVE-2022-4712 | High | 7.2 | 2023-10-20 | The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, a… |
CVE-2022-42150 | Critical | 10.0 | 2023-10-19 | TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape. |
CVE-2022-47583 | Critical | 9.8 | 2023-10-19 | Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal. |
CVE-2022-37830 | Critical | 9.6 | 2023-10-19 | Interway a.s WebJET CMS 8.6.896 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-27813 | High | 8.1 | 2023-10-19 | Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memo… |
CVE-2022-26943 | High | 8.8 | 2023-10-19 | The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottim… |
CVE-2022-26942 | High | 8.2 | 2023-10-19 | The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one res… |
CVE-2022-26941 | Critical | 9.6 | 2023-10-19 | A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is imprope… |
CVE-2022-25334 | High | 8.2 | 2023-10-19 | The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) lacks a bounds check on the signature size field in the SK_LOAD module lo… |
CVE-2022-25333 | High | 8.2 | 2023-10-19 | The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module throu… |
CVE-2022-25332 | Medium | 4.4 | 2023-10-19 | The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by… |
CVE-2022-24404 | Medium | 5.9 | 2023-10-19 | Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulat… |
CVE-2022-24402 | High | 8.8 | 2023-10-19 | The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystr… |
CVE-2022-24401 | High | 8.8 | 2023-10-19 | Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame c… |
CVE-2022-24400 | High | 7.5 | 2023-10-19 | A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero. |
CVE-2022-3761 | Medium | 5.9 | 2023-10-17 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuratio… |
CVE-2022-43892 | Low | 3.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which cou… |
CVE-2022-43891 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-43893 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634. |
CVE-2022-43889 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks agai… |
CVE-2022-22386 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St… |
CVE-2022-22385 | Medium | 5.9 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force… |
CVE-2022-22380 | Medium | 5.0 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID… |
CVE-2022-22375 | High | 7.2 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2022-22384 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Fo… |
CVE-2022-22377 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Str… |
CVE-2022-48612 | Medium | 6.1 | 2023-10-16 | A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpag… |
CVE-2022-43868 | Medium | 5.3 | 2023-10-14 | IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID… |
CVE-2022-43740 | High | 7.5 | 2023-10-14 | IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238… |
CVE-2022-33165 | Medium | 6.8 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2022-33161 | Medium | 5.3 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2022-32755 | Medium | 5.5 | 2023-10-14 | IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit th… |
CVE-2022-44758 | Medium | 6.5 | 2023-10-11 | BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly… |
CVE-2022-44757 | Medium | 6.5 | 2023-10-11 | BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive in… |
CVE-2022-42451 | Medium | 4.6 | 2023-10-11 | Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user. |
CVE-2022-22298 | Medium | 6.7 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1… |
CVE-2022-30527 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing… |
CVE-2022-48183 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-48182 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-3728 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-36228 | Medium | 6.5 | 2023-10-09 | Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the… |
CVE-2022-3431 | Medium | 6.7 | 2023-10-09 | A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow… |
CVE-2022-35950 | Medium | 6.9 | 2023-10-09 | OroCommerce is an open-source Business to Business Commerce application. In versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 prior to 5.0.11, and 5.1… |
CVE-2022-33160 | Low | 3.7 | 2023-10-06 | IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2022-34355 | Medium | 4.0 | 2023-10-06 | IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that co… |
CVE-2022-47175 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions. |
CVE-2022-3248 | Medium | 4.4 | 2023-10-05 | A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries… |
CVE-2022-4145 | Medium | 4.3 | 2023-10-05 | A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling th… |
CVE-2022-36277 | Medium | 6.5 | 2023-10-04 | The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1… |
CVE-2022-36276 | Critical | 9.9 | 2023-10-04 | TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might al… |
CVE-2022-43906 | Low | 3.1 | 2023-10-04 | IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 24089… |
CVE-2022-4132 | Medium | 5.9 | 2023-10-04 | A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the… |
CVE-2022-22447 | Medium | 4.0 | 2023-10-04 | IBM Disconnected Log Collector 1.0 through 1.8.2 is vulnerable to potential security misconfigurations that could disclose unintended information. IBM X-Force… |
CVE-2022-47893 | Critical | 10.0 | 2023-10-03 | There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, t… |
CVE-2022-47892 | Medium | 5.3 | 2023-10-03 | All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials. |
CVE-2022-47891 | High | 8.1 | 2023-10-03 | All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery… |
CVE-2022-46841 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions. |
CVE-2022-4956 | High | 7.8 | 2023-09-30 | A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The… |
CVE-2022-35908 | High | 8.8 | 2023-09-29 | Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent. |
CVE-2022-47187 | Medium | 5.3 | 2023-09-28 | There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file wi… |