2022 CVEs (page 32)
Page 32 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48560 | High | 7.5 | 2023-08-22 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. |
CVE-2022-48554 | Medium | 5.5 | 2023-08-22 | File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project. |
CVE-2022-48547 | Medium | 6.1 | 2023-08-22 | A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML… |
CVE-2022-48545 | Medium | 5.5 | 2023-08-22 | An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02. |
CVE-2022-48541 | High | 7.1 | 2023-08-22 | A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command. |
CVE-2022-48538 | Medium | 5.3 | 2023-08-22 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a ze… |
CVE-2022-48522 | Critical | 9.8 | 2023-08-22 | In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. |
CVE-2022-48174 | Critical | 9.8 | 2023-08-22 | There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed fr… |
CVE-2022-48065 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c. |
CVE-2022-48064 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwar… |
CVE-2022-48063 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The at… |
CVE-2022-47696 | High | 7.8 | 2023-08-22 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. |
CVE-2022-47695 | High | 7.8 | 2023-08-22 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_s… |
CVE-2022-47673 | High | 7.8 | 2023-08-22 | An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or… |
CVE-2022-47069 | High | 7.8 | 2023-08-22 | p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/Zi… |
CVE-2022-47022 | Medium | 4.7 | 2023-08-22 | An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. |
CVE-2022-47011 | Medium | 5.5 | 2023-08-22 | An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory le… |
CVE-2022-47010 | Medium | 5.5 | 2023-08-22 | An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
CVE-2022-47008 | Medium | 5.5 | 2023-08-22 | An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to m… |
CVE-2022-47007 | Medium | 5.5 | 2023-08-22 | An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
CVE-2022-45703 | High | 7.8 | 2023-08-22 | Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c. |
CVE-2022-45611 | Critical | 9.8 | 2023-08-22 | An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated privileges via via capture of user login information. |
CVE-2022-45582 | Medium | 6.1 | 2023-08-22 | Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter. |
CVE-2022-44840 | High | 7.8 | 2023-08-22 | Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. |
CVE-2022-44730 | Medium | 4.4 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A… |
CVE-2022-44729 | High | 7.1 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. O… |
CVE-2022-44215 | Medium | 6.1 | 2023-08-22 | There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL. |
CVE-2022-43358 | High | 7.5 | 2023-08-22 | Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by att… |
CVE-2022-43357 | High | 7.5 | 2023-08-22 | Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by… |
CVE-2022-41444 | Medium | 6.1 | 2023-08-22 | Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php. |
CVE-2022-40090 | Medium | 6.5 | 2023-08-22 | An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. |
CVE-2022-38349 | Medium | 6.5 | 2023-08-22 | An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDo… |
CVE-2022-37052 | Medium | 6.5 | 2023-08-22 | A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. |
CVE-2022-37051 | Medium | 6.5 | 2023-08-22 | An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream… |
CVE-2022-37050 | Medium | 6.5 | 2023-08-22 | In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in… |
CVE-2022-36648 | Critical | 10.0 | 2023-08-22 | The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host q… |
CVE-2022-35206 | Medium | 5.5 | 2023-08-22 | Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c. |
CVE-2022-35205 | Medium | 5.5 | 2023-08-22 | An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. |
CVE-2022-34038 | High | 7.5 | 2023-08-22 | Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is no… |
CVE-2022-29654 | Medium | 5.5 | 2023-08-22 | Buffer overflow vulnerability in quote_for_pmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file. |
CVE-2022-28073 | High | 7.5 | 2023-08-22 | A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0. |
CVE-2022-28072 | High | 7.5 | 2023-08-22 | A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0. |
CVE-2022-28071 | High | 7.5 | 2023-08-22 | A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0. |
CVE-2022-28070 | High | 7.5 | 2023-08-22 | A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0. |
CVE-2022-28069 | High | 7.5 | 2023-08-22 | A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0. |
CVE-2022-28068 | High | 7.5 | 2023-08-22 | A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0. |
CVE-2022-26592 | High | 8.8 | 2023-08-22 | Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. |
CVE-2022-25024 | High | 7.5 | 2023-08-22 | The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of… |
CVE-2022-46751 | High | 8.2 | 2023-08-21 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This is… |
CVE-2022-24989 | Critical | 9.8 | 2023-08-20 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instanti… |
CVE-2022-4894 | High | 7.3 | 2023-08-16 | Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path Element. |
CVE-2022-4782 | Medium | 5.4 | 2023-08-16 | The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as con… |
CVE-2022-48503 | High | 8.8 | 2023-08-14 | The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6… |
CVE-2022-46725 | Medium | 4.3 | 2023-08-14 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.4 and iPadOS 16.4. Vis… |
CVE-2022-46724 | Low | 2.4 | 2023-08-14 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with physical access to a… |
CVE-2022-46722 | Medium | 5.5 | 2023-08-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system. |
CVE-2022-46706 | High | 7.8 | 2023-08-14 | A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur… |
CVE-2022-42828 | High | 8.8 | 2023-08-14 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-32876 | Low | 3.3 | 2023-08-14 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13. A shortcut may be able to view the hidden photos album without… |
CVE-2022-26699 | Medium | 5.5 | 2023-08-14 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to cause a denial-of-service to Endpoin… |
CVE-2022-22655 | Medium | 5.5 | 2023-08-14 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4. An app may be able to lea… |
CVE-2022-22646 | Medium | 5.5 | 2023-08-14 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to modify protected p… |
CVE-2022-4953 | Medium | 6.1 | 2023-08-14 | The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inje… |
CVE-2022-46329 | High | 8.2 | 2023-08-11 | Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via loca… |
CVE-2022-45112 | High | 7.3 | 2023-08-11 | Improper access control in some Intel(R) VROC software before version 8.0.0.4035 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2022-44612 | Medium | 5.5 | 2023-08-11 | Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information… |
CVE-2022-44611 | Medium | 6.9 | 2023-08-11 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via adjac… |
CVE-2022-43505 | Medium | 4.1 | 2023-08-11 | Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via… |
CVE-2022-43456 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticate… |
CVE-2022-41984 | Medium | 4.4 | 2023-08-11 | Protection mechanism failure for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow… |
CVE-2022-41804 | High | 7.2 | 2023-08-11 | Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation… |
CVE-2022-40982 | Medium | 6.5 | 2023-08-11 | Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an aut… |
CVE-2022-40964 | High | 7.9 | 2023-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of pri… |
CVE-2022-38973 | Low | 3.3 | 2023-08-11 | Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an a… |
CVE-2022-38102 | High | 7.2 | 2023-08-11 | Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged us… |
CVE-2022-38083 | Medium | 6.1 | 2023-08-11 | Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local ac… |
CVE-2022-38076 | Low | 3.8 | 2023-08-11 | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation o… |
CVE-2022-37343 | High | 7.2 | 2023-08-11 | Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local a… |
CVE-2022-37336 | High | 7.9 | 2023-08-11 | Improper input validation in BIOS firmware for some Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-36392 | High | 8.6 | 2023-08-11 | Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70… |
CVE-2022-36372 | High | 7.5 | 2023-08-11 | Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-36351 | Medium | 4.3 | 2023-08-11 | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of… |
CVE-2022-34657 | Medium | 6.0 | 2023-08-11 | Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information discl… |
CVE-2022-29887 | High | 8.1 | 2023-08-11 | Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentially enable escalat… |
CVE-2022-29871 | Medium | 6.7 | 2023-08-11 | Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of p… |
CVE-2022-29470 | Medium | 6.7 | 2023-08-11 | Improper access control in the Intel® DTT Software before version 8.7.10400.15482 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2022-27879 | Medium | 5.3 | 2023-08-11 | Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via loc… |
CVE-2022-27635 | High | 8.2 | 2023-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of pri… |
CVE-2022-25864 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-47636 | High | 7.8 | 2023-08-10 | A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Langu… |
CVE-2022-44629 | Medium | 4.8 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions. |
CVE-2022-27861 | Medium | 4.7 | 2023-08-10 | Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions. |
CVE-2022-48604 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directl… |
CVE-2022-48603 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it… |
CVE-2022-48602 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48601 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48600 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to… |
CVE-2022-48599 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it d… |
CVE-2022-48598 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes… |
CVE-2022-48597 | High | 8.8 | 2023-08-09 | A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it di… |