2022 CVEs (page 36)
Page 36 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-33230 | Medium | 6.7 | 2023-06-06 | Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host |
CVE-2022-33227 | Medium | 6.7 | 2023-06-06 | Memory corruption in Linux android due to double free while calling unregister provider after register call. |
CVE-2022-33226 | Medium | 6.7 | 2023-06-06 | Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications. |
CVE-2022-33224 | Medium | 6.7 | 2023-06-06 | Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries. |
CVE-2022-22076 | High | 7.1 | 2023-06-06 | information disclosure due to cryptographic issue in Core during RPMB read request. |
CVE-2022-22060 | High | 7.5 | 2023-06-06 | Assertion occurs while processing Reconfiguration message due to improper validation |
CVE-2022-48448 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48447 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48446 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48445 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48444 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48443 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48442 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48441 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48440 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48439 | Medium | 4.4 | 2023-06-06 | In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution priv… |
CVE-2022-48438 | Medium | 4.4 | 2023-06-06 | In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution priv… |
CVE-2022-48392 | High | 7.8 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48391 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48390 | High | 7.8 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48188 | Medium | 6.7 | 2023-06-05 | A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to el… |
CVE-2022-48181 | Medium | 6.7 | 2023-06-05 | An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their pri… |
CVE-2022-4569 | High | 7.8 | 2023-06-05 | A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execu… |
CVE-2022-4946 | Medium | 5.4 | 2023-06-05 | The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role a… |
CVE-2022-24695 | Medium | 4.3 | 2023-06-02 | Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode… |
CVE-2022-47617 | High | 7.2 | 2023-06-02 | Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files us… |
CVE-2022-47616 | High | 7.2 | 2023-06-02 | Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can u… |
CVE-2022-46308 | High | 8.8 | 2023-06-02 | SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit thi… |
CVE-2022-46307 | High | 8.8 | 2023-06-02 | SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vul… |
CVE-2022-45938 | Critical | 9.0 | 2023-06-02 | An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inve… |
CVE-2022-43760 | High | 8.4 | 2023-06-01 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged gr… |
CVE-2022-4333 | Critical | 9.8 | 2023-06-01 | Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be dea… |
CVE-2022-4332 | Medium | 6.8 | 2023-06-01 | In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x a vulnerable firmware verification has been identified. Through physical access and hardware mani… |
CVE-2022-35742 | High | 7.5 | 2023-06-01 | Microsoft Outlook Denial of Service Vulnerability |
CVE-2022-48502 | High | 7.1 | 2023-05-31 | An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bou… |
CVE-2022-35759 | Medium | 6.5 | 2023-05-31 | Windows Local Security Authority (LSA) Denial of Service Vulnerability |
CVE-2022-35758 | Medium | 5.5 | 2023-05-31 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2022-35757 | High | 7.3 | 2023-05-31 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2022-35756 | High | 7.8 | 2023-05-31 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2022-35755 | High | 7.3 | 2023-05-31 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-35754 | Medium | 6.7 | 2023-05-31 | Unified Write Filter Elevation of Privilege Vulnerability |
CVE-2022-35753 | High | 8.1 | 2023-05-31 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-35752 | High | 8.1 | 2023-05-31 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-35751 | High | 7.8 | 2023-05-31 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2022-35750 | High | 7.8 | 2023-05-31 | Win32k Elevation of Privilege Vulnerability |
CVE-2022-35749 | High | 7.8 | 2023-05-31 | Windows Digital Media Receiver Elevation of Privilege Vulnerability |
CVE-2022-35748 | High | 7.5 | 2023-05-31 | HTTP.sys Denial of Service Vulnerability |
CVE-2022-35747 | Medium | 5.9 | 2023-05-31 | Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability |
CVE-2022-35746 | High | 7.8 | 2023-05-31 | Windows Digital Media Receiver Elevation of Privilege Vulnerability |
CVE-2022-35745 | High | 8.1 | 2023-05-31 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-35744 | Critical | 9.8 | 2023-05-31 | Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability |
CVE-2022-35743 | High | 7.8 | 2023-05-31 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability |
CVE-2022-47526 | Critical | 9.8 | 2023-05-31 | Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could lever… |
CVE-2022-47525 | High | 7.5 | 2023-05-31 | Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerabilit… |
CVE-2022-39075 | High | 7.1 | 2023-05-30 | There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system file… |
CVE-2022-39074 | Low | 3.3 | 2023-05-30 | There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could start a non-public inte… |
CVE-2022-39071 | High | 7.1 | 2023-05-30 | There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system c… |
CVE-2022-47029 | High | 7.8 | 2023-05-30 | An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update. |
CVE-2022-47028 | Medium | 5.5 | 2023-05-30 | An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert. |
CVE-2022-36250 | High | 8.8 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-36249 | Medium | 5.4 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are direc… |
CVE-2022-36247 | Critical | 9.1 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za. |
CVE-2022-36246 | Critical | 9.8 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions. |
CVE-2022-36244 | Medium | 5.4 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat… |
CVE-2022-36243 | Medium | 5.3 | 2023-05-30 | Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure T… |
CVE-2022-4240 | Medium | 6.5 | 2023-05-30 | Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1 |
CVE-2022-46361 | Medium | 6.9 | 2023-05-30 | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along… |
CVE-2022-43485 | Medium | 6.2 | 2023-05-30 | Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue aff… |
CVE-2022-45853 | Medium | 6.7 | 2023-05-30 | The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an… |
CVE-2022-4676 | Medium | 5.4 | 2023-05-30 | The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor… |
CVE-2022-41766 | Medium | 4.3 | 2023-05-29 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyro… |
CVE-2022-24632 | Medium | 5.3 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php vi… |
CVE-2022-24631 | Medium | 5.4 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter. |
CVE-2022-24630 | High | 7.2 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field… |
CVE-2022-24629 | Critical | 9.8 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir… |
CVE-2022-24628 | High | 7.2 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareE… |
CVE-2022-24627 | Critical | 9.8 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_… |
CVE-2022-45372 | Medium | 4.3 | 2023-05-29 | Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions. |
CVE-2022-33974 | Medium | 5.4 | 2023-05-29 | Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions. |
CVE-2022-36345 | Medium | 4.3 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions. |
CVE-2022-48480 | High | 7.5 | 2023-05-26 | Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2022-48479 | Critical | 9.8 | 2023-05-26 | The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions… |
CVE-2022-48478 | Critical | 9.8 | 2023-05-26 | The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial r… |
CVE-2022-46945 | Critical | 9.1 | 2023-05-26 | Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php. |
CVE-2022-39374 | Medium | 6.5 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the s… |
CVE-2022-39335 | Medium | 5.0 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request… |
CVE-2022-47174 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. |
CVE-2022-45366 | High | 7.1 | 2023-05-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.4 versions. |
CVE-2022-47178 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <= 8.4.7 versions. |
CVE-2022-47144 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions. |
CVE-2022-47136 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions. |
CVE-2022-46856 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <= 4.3.3 versions. |
CVE-2022-46820 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <= 1.3.9 versions. |
CVE-2022-46814 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lebedel Kodex Posts likes plugin <= 2.4.3 versions. |
CVE-2022-46810 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions. |
CVE-2022-45815 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions. |
CVE-2022-45371 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions. |
CVE-2022-43490 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions. |
CVE-2022-41987 | Medium | 6.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions. |
CVE-2022-38716 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions. |