2022 CVEs (page 39)
Page 39 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48239 | Medium | 4.4 | 2023-05-09 | In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-48238 | Medium | 4.4 | 2023-05-09 | In Image filter, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privil… |
CVE-2022-48237 | Medium | 4.4 | 2023-05-09 | In Image filter, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privil… |
CVE-2022-48236 | Medium | 4.4 | 2023-05-09 | In MP3 encoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2022-48235 | Medium | 4.4 | 2023-05-09 | In MP3 encoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2022-48234 | Medium | 5.5 | 2023-05-09 | In FM service , there is a possible missing params check. This could lead to local denial of service in FM service . |
CVE-2022-48233 | Medium | 5.5 | 2023-05-09 | In FM service , there is a possible missing params check. This could lead to local denial of service in FM service . |
CVE-2022-48232 | Medium | 5.5 | 2023-05-09 | In FM service , there is a possible missing params check. This could lead to local denial of service in FM service . |
CVE-2022-48231 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-47499 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47498 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47497 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47496 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47495 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47494 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47493 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-47492 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-47491 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47490 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-47489 | Medium | 4.4 | 2023-05-09 | In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-47488 | Medium | 4.4 | 2023-05-09 | In spipe drive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2022-47487 | Medium | 5.5 | 2023-05-09 | In thermal service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service local denial of service w… |
CVE-2022-47486 | Medium | 4.4 | 2023-05-09 | In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution… |
CVE-2022-47485 | Medium | 4.4 | 2023-05-09 | In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System executio… |
CVE-2022-47470 | Medium | 4.4 | 2023-05-09 | In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileg… |
CVE-2022-47469 | Medium | 4.4 | 2023-05-09 | In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileg… |
CVE-2022-47340 | Medium | 5.5 | 2023-05-09 | In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional ex… |
CVE-2022-47334 | Medium | 4.4 | 2023-05-09 | In phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution pr… |
CVE-2022-44433 | High | 7.8 | 2023-05-09 | In phoneEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-44420 | Medium | 5.5 | 2023-05-09 | In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no additional execution p… |
CVE-2022-44419 | Medium | 5.5 | 2023-05-09 | In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE. This could local denial of service with no additional ex… |
CVE-2022-39089 | Medium | 4.4 | 2023-05-09 | In mlog service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2022-38685 | Medium | 5.5 | 2023-05-09 | In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional executio… |
CVE-2022-46720 | High | 8.6 | 2023-05-08 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to br… |
CVE-2022-32885 | High | 8.8 | 2023-05-08 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing… |
CVE-2022-47439 | High | 7.1 | 2023-05-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rocket Apps Open Graphite plugin <= 1.6.0 versions. |
CVE-2022-47437 | Medium | 5.9 | 2023-05-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <= 1.1.8 versions. |
CVE-2022-45065 | High | 7.1 | 2023-05-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Squirrly SEO Plugin by Squirrly SEO plugin <= 12.1.20 versions. |
CVE-2022-4118 | Critical | 9.8 | 2023-05-08 | The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a paramet… |
CVE-2022-45812 | Medium | 6.5 | 2023-05-08 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <= 2.6.8 versions. |
CVE-2022-46799 | High | 7.1 | 2023-05-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin <= 1.0.15 versions. |
CVE-2022-43877 | Medium | 5.1 | 2023-05-06 | IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-… |
CVE-2022-22313 | Medium | 4.4 | 2023-05-06 | IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2022-43866 | Medium | 5.4 | 2023-05-05 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2022-43919 | Medium | 5.3 | 2023-05-05 | IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service. IBM X-For… |
CVE-2022-38707 | Medium | 4.0 | 2023-05-05 | IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 23417… |
CVE-2022-45048 | High | 8.4 | 2023-05-05 | Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache… |
CVE-2022-47449 | High | 7.1 | 2023-05-04 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin <= 3.1.5 versions. |
CVE-2022-47434 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <= 4.0.5 versions. |
CVE-2022-45818 | Medium | 6.5 | 2023-05-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin <= 1.3.4 versions. |
CVE-2022-4259 | High | 8.8 | 2023-05-04 | Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker t… |
CVE-2022-47757 | Critical | 9.8 | 2023-05-04 | In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's d… |
CVE-2022-4376 | Low | 3.1 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11… |
CVE-2022-45860 | Medium | 5.3 | 2023-05-03 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versi… |
CVE-2022-45859 | Medium | 4.1 | 2023-05-03 | An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all vers… |
CVE-2022-45858 | Medium | 4.2 | 2023-05-03 | A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all… |
CVE-2022-43950 | Medium | 4.3 | 2023-05-03 | A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions… |
CVE-2022-39161 | Medium | 4.8 | 2023-05-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins… |
CVE-2022-46852 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Table Builder plugin <= 1.4.6 versions. |
CVE-2022-43681 | Medium | 6.5 | 2023-05-03 | An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (… |
CVE-2022-40318 | Medium | 6.5 | 2023-05-03 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), att… |
CVE-2022-40302 | Medium | 6.5 | 2023-05-03 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), att… |
CVE-2022-3405 | High | 8.8 | 2023-05-03 | Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber P… |
CVE-2022-30995 | High | 7.5 | 2023-05-03 | Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29… |
CVE-2022-30759 | High | 8.8 | 2023-05-02 | In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute a… |
CVE-2022-47878 | High | 8.8 | 2023-05-02 | Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as We… |
CVE-2022-47877 | Medium | 5.4 | 2023-05-02 | A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in the Logs page via th… |
CVE-2022-47876 | High | 8.8 | 2023-05-02 | The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts. |
CVE-2022-47875 | High | 8.8 | 2023-05-02 | A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code. |
CVE-2022-47874 | Medium | 6.5 | 2023-05-02 | Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'com.jedox… |
CVE-2022-40504 | High | 7.5 | 2023-05-02 | Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network. |
CVE-2022-33273 | High | 7.3 | 2023-05-02 | Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation. |
CVE-2022-40508 | High | 7.5 | 2023-05-02 | Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported. |
CVE-2022-40505 | High | 8.2 | 2023-05-02 | Information disclosure due to buffer over-read in Modem while parsing DNS hostname. |
CVE-2022-34144 | High | 7.5 | 2023-05-02 | Transient DOS due to reachable assertion in Modem during OSI decode scheduling. |
CVE-2022-33305 | High | 7.5 | 2023-05-02 | Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH. |
CVE-2022-33304 | High | 7.5 | 2023-05-02 | Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet. |
CVE-2022-33292 | High | 7.8 | 2023-05-02 | Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it. |
CVE-2022-33281 | Medium | 6.7 | 2023-05-02 | Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames. |
CVE-2022-25713 | High | 7.8 | 2023-05-02 | Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key. |
CVE-2022-48483 | High | 7.5 | 2023-05-02 | 3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory tra… |
CVE-2022-48482 | High | 7.5 | 2023-05-02 | 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directo… |
CVE-2022-35898 | Critical | 9.8 | 2023-05-01 | OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the p… |
CVE-2022-4568 | High | 7.0 | 2023-05-01 | A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. |
CVE-2022-48186 | Medium | 6.2 | 2023-05-01 | A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. |
CVE-2022-46365 | Critical | 9.1 | 2023-05-01 | Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter… |
CVE-2022-45802 | Critical | 9.8 | 2023-05-01 | Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high… |
CVE-2022-45801 | Medium | 5.4 | 2023-05-01 | Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP st… |
CVE-2022-43871 | Medium | 4.6 | 2023-04-29 | IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2022-41736 | High | 8.4 | 2023-04-29 | IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0 contains an unspecified vulnerability that could allow a local user to obtain roo… |
CVE-2022-31643 | Medium | 5.5 | 2023-04-28 | A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmwar… |
CVE-2022-41400 | Critical | 9.8 | 2023-04-28 | Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in… |
CVE-2022-41399 | High | 7.5 | 2023-04-28 | The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database conn… |
CVE-2022-41398 | High | 7.5 | 2023-04-28 | The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue… |
CVE-2022-41397 | Critical | 9.8 | 2023-04-28 | The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and… |
CVE-2022-38583 | High | 7.8 | 2023-04-28 | On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privile… |
CVE-2022-48481 | Medium | 5.2 | 2023-04-28 | In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible |
CVE-2022-25091 | Medium | 5.3 | 2023-04-27 | Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the… |
CVE-2022-38730 | Medium | 6.3 | 2023-04-27 | Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-ro… |
CVE-2022-37326 | High | 7.8 | 2023-04-27 | Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling… |