2022 CVEs (page 31)
Page 31 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47186 | High | 7.5 | 2023-09-28 | There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any… |
CVE-2022-48606 | High | 7.5 | 2023-09-27 | Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability. |
CVE-2022-4318 | High | 7.8 | 2023-09-25 | A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. |
CVE-2022-4245 | Medium | 4.3 | 2023-09-25 | A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue mean… |
CVE-2022-4244 | High | 7.5 | 2023-09-25 | A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the inte… |
CVE-2022-4137 | High | 8.1 | 2023-09-25 | A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious l… |
CVE-2022-48605 | Critical | 9.8 | 2023-09-25 | Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availabil… |
CVE-2022-3962 | Medium | 4.3 | 2023-09-23 | A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed ca… |
CVE-2022-4039 | High | 8.0 | 2023-09-22 | A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allow… |
CVE-2022-3874 | High | 8.0 | 2023-09-22 | A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands throu… |
CVE-2022-3596 | High | 7.5 | 2023-09-20 | An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP… |
CVE-2022-3916 | Medium | 6.8 | 2023-09-20 | A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due t… |
CVE-2022-1438 | Medium | 6.4 | 2023-09-20 | A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS… |
CVE-2022-45448 | Low | 3.5 | 2023-09-20 | M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pd… |
CVE-2022-45447 | Medium | 6.5 | 2023-09-20 | M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly ch… |
CVE-2022-47562 | High | 7.5 | 2023-09-20 | Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition. |
CVE-2022-47561 | High | 7.3 | 2023-09-20 | The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an atta… |
CVE-2022-47560 | Medium | 5.7 | 2023-09-20 | The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user i… |
CVE-2022-47559 | High | 8.6 | 2023-09-19 | Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is… |
CVE-2022-47558 | Critical | 9.4 | 2023-09-19 | Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker… |
CVE-2022-47557 | Medium | 6.1 | 2023-09-19 | Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileg… |
CVE-2022-47556 | Medium | 6.5 | 2023-09-19 | Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a… |
CVE-2022-47555 | Critical | 9.3 | 2023-09-19 | Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated priv… |
CVE-2022-47554 | High | 8.2 | 2023-09-19 | Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, includ… |
CVE-2022-47553 | High | 8.6 | 2023-09-19 | Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, withou… |
CVE-2022-28357 | Critical | 9.8 | 2023-09-19 | NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account. |
CVE-2022-3261 | Medium | 4.4 | 2023-09-15 | A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a discl… |
CVE-2022-47848 | High | 7.5 | 2023-09-15 | An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07… |
CVE-2022-3466 | Medium | 4.8 | 2023-09-15 | The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, r… |
CVE-2022-20917 | Medium | 4.3 | 2023-09-15 | A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attack… |
CVE-2022-47631 | High | 7.8 | 2023-09-14 | Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLL… |
CVE-2022-35849 | High | 7.8 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0… |
CVE-2022-47637 | Medium | 6.7 | 2023-09-12 | The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory. Common use cases execute files under C:\xampp with administrative… |
CVE-2022-4896 | High | 8.2 | 2023-09-12 | Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR"… |
CVE-2022-48475 | High | 8.2 | 2023-09-12 | Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Over… |
CVE-2022-48474 | High | 8.2 | 2023-09-12 | Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the… |
CVE-2022-24093 | Critical | 9.1 | 2023-09-12 | Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issu… |
CVE-2022-1415 | High | 8.1 | 2023-09-11 | A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to… |
CVE-2022-23382 | High | 8.1 | 2023-09-11 | Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in… |
CVE-2022-34238 | Medium | 5.5 | 2023-09-11 | Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 20.005.30334 (and earlier) are affected by an out-of-bounds read vulnerabili… |
CVE-2022-34227 | High | 7.8 | 2023-09-11 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34224 | High | 7.8 | 2023-09-11 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-28836 | High | 7.8 | 2023-09-11 | Adobe InCopy versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exe… |
CVE-2022-28835 | High | 7.8 | 2023-09-11 | Adobe InCopy versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an Use-After-Free vulnerability that could result in arbitrary code executio… |
CVE-2022-28834 | High | 7.8 | 2023-09-11 | Adobe InCopy versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exe… |
CVE-2022-28833 | High | 7.8 | 2023-09-11 | Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code ex… |
CVE-2022-28832 | High | 7.8 | 2023-09-11 | Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which coul… |
CVE-2022-28831 | High | 7.8 | 2023-09-11 | Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code ex… |
CVE-2022-22409 | Medium | 5.3 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Fo… |
CVE-2022-22402 | Medium | 5.4 | 2023-09-08 | IBM Aspera Faspex 5.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2022-22401 | Medium | 5.9 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567. |
CVE-2022-22405 | Medium | 5.9 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2022-33164 | High | 8.7 | 2023-09-08 | IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request… |
CVE-2022-27599 | Medium | 6.7 | 2023-09-08 | An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local… |
CVE-2022-30646 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30645 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30644 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code exe… |
CVE-2022-30643 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30642 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30641 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30640 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30639 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30638 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-30637 | High | 7.8 | 2023-09-07 | Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-32920 | Medium | 5.5 | 2023-09-06 | The issue was addressed with improved checks. This issue is fixed in Xcode 14.0. Parsing a file may lead to disclosure of user information. |
CVE-2022-41763 | High | 8.8 | 2023-09-05 | An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS s… |
CVE-2022-40534 | High | 8.4 | 2023-09-05 | Memory corruption due to improper validation of array index in Audio. |
CVE-2022-40524 | Medium | 6.7 | 2023-09-05 | Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service. |
CVE-2022-33275 | High | 8.4 | 2023-09-05 | Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range. |
CVE-2022-33220 | Medium | 5.1 | 2023-09-05 | Information disclosure in Automotive multimedia due to buffer over-read. |
CVE-2022-43903 | Medium | 4.3 | 2023-09-05 | IBM Security Guardium 10.6, 11.3, and 11.4 could allow an authenticated user to cause a denial of service due to due to improper input validation. IBM X-Force… |
CVE-2022-48453 | Medium | 4.4 | 2023-09-04 | In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-48452 | Medium | 4.4 | 2023-09-04 | In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed |
CVE-2022-47353 | Medium | 4.4 | 2023-09-04 | In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges n… |
CVE-2022-47352 | Medium | 4.4 | 2023-09-04 | In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privil… |
CVE-2022-3407 | Medium | 4.9 | 2023-09-01 | I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a… |
CVE-2022-22305 | Medium | 5.4 | 2023-09-01 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; Fo… |
CVE-2022-4343 | Medium | 5.0 | 2023-09-01 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions… |
CVE-2022-46527 | High | 7.5 | 2023-09-01 | ELSYS ERS 1.5 Sound v2.3.8 was discovered to contain a buffer overflow via the NFC data parser. |
CVE-2022-44349 | Medium | 5.4 | 2023-09-01 | NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-46869 | High | 7.8 | 2023-08-31 | Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Wind… |
CVE-2022-46868 | High | 7.8 | 2023-08-31 | Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows)… |
CVE-2022-45451 | High | 7.8 | 2023-08-31 | Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo… |
CVE-2022-1601 | Medium | 5.3 | 2023-08-30 | The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it poss… |
CVE-2022-46783 | Medium | 5.3 | 2023-08-28 | An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted a… |
CVE-2022-43904 | High | 7.5 | 2023-08-28 | IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM… |
CVE-2022-43909 | Medium | 4.6 | 2023-08-27 | IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2022-43907 | High | 7.2 | 2023-08-27 | IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2022-4452 | High | 8.8 | 2023-08-25 | Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted… |
CVE-2022-46884 | High | 8.8 | 2023-08-24 | A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have lead to memory corr… |
CVE-2022-3746 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to ca… |
CVE-2022-3745 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to vi… |
CVE-2022-3744 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to un… |
CVE-2022-3743 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under… |
CVE-2022-3742 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to ex… |
CVE-2022-48571 | High | 7.5 | 2023-08-22 | memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP. |
CVE-2022-48570 | High | 7.5 | 2023-08-22 | Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the… |
CVE-2022-48566 | Medium | 5.9 | 2023-08-22 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variab… |
CVE-2022-48565 | Critical | 9.8 | 2023-08-22 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoi… |
CVE-2022-48564 | Medium | 6.5 | 2023-08-22 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property Li… |