2022 CVEs (page 41)
Page 41 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45030 | High | 8.8 | 2023-04-15 | A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv). |
CVE-2022-43699 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls th… |
CVE-2022-43698 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list. |
CVE-2022-43697 | Medium | 6.1 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob. |
CVE-2022-43696 | Medium | 6.1 | 2023-04-15 | OX App Suite before 7.10.6-rev20 allows XSS via upsell ads. |
CVE-2022-48178 | Medium | 5.4 | 2023-04-15 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an inde… |
CVE-2022-48177 | Medium | 5.4 | 2023-04-15 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records… |
CVE-2022-46886 | Medium | 5.5 | 2023-04-14 | There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when cl… |
CVE-2022-47501 | High | 7.5 | 2023-04-14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue af… |
CVE-2022-3748 | Critical | 9.8 | 2023-04-14 | Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through… |
CVE-2022-45180 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious… |
CVE-2022-45178 | High | 8.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate e… |
CVE-2022-45175 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/we… |
CVE-2022-45174 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_cod… |
CVE-2022-45173 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challen… |
CVE-2022-45170 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malici… |
CVE-2022-47027 | Critical | 9.8 | 2023-04-14 | Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnera… |
CVE-2022-48468 | Medium | 5.5 | 2023-04-13 | protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member. |
CVE-2022-45358 | Medium | 5.4 | 2023-04-13 | Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions. |
CVE-2022-44625 | Medium | 4.8 | 2023-04-13 | Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions. |
CVE-2022-45064 | High | 8.0 | 2023-04-13 | The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on th… |
CVE-2022-40532 | High | 8.4 | 2023-04-13 | Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target. |
CVE-2022-40503 | High | 8.2 | 2023-04-13 | Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming. |
CVE-2022-33302 | Medium | 6.8 | 2023-04-13 | Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length. |
CVE-2022-33301 | Medium | 6.7 | 2023-04-13 | Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM. |
CVE-2022-33298 | Medium | 6.7 | 2023-04-13 | Memory corruption due to use after free in Modem while modem initialization. |
CVE-2022-33297 | Medium | 6.8 | 2023-04-13 | Information disclosure due to buffer overread in Linux sensors |
CVE-2022-33296 | Medium | 5.9 | 2023-04-13 | Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message. |
CVE-2022-33295 | High | 8.2 | 2023-04-13 | Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length. |
CVE-2022-33294 | High | 7.5 | 2023-04-13 | Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message. |
CVE-2022-33291 | High | 8.2 | 2023-04-13 | Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length. |
CVE-2022-33289 | Medium | 6.8 | 2023-04-13 | Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card. |
CVE-2022-33288 | Critical | 9.3 | 2023-04-13 | Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information. |
CVE-2022-33287 | High | 8.2 | 2023-04-13 | Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet. |
CVE-2022-33282 | High | 8.4 | 2023-04-13 | Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback. |
CVE-2022-33270 | High | 7.5 | 2023-04-13 | Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message. |
CVE-2022-33269 | Critical | 9.3 | 2023-04-13 | Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment. |
CVE-2022-33259 | Critical | 9.8 | 2023-04-13 | Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received. |
CVE-2022-33258 | High | 8.2 | 2023-04-13 | Information disclosure due to buffer over-read in modem while reading configuration parameters. |
CVE-2022-33231 | Critical | 9.3 | 2023-04-13 | Memory corruption due to double free in core while initializing the encryption key. |
CVE-2022-33228 | High | 8.2 | 2023-04-13 | Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header. |
CVE-2022-33223 | High | 7.5 | 2023-04-13 | Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding. |
CVE-2022-33222 | High | 8.2 | 2023-04-13 | Information disclosure due to buffer over-read while parsing DNS response packets in Modem. |
CVE-2022-33211 | Critical | 9.8 | 2023-04-13 | memory corruption in modem due to improper check while calculating size of serialized CoAP message |
CVE-2022-25747 | High | 8.2 | 2023-04-13 | Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message |
CVE-2022-25745 | Critical | 9.8 | 2023-04-13 | Memory corruption in modem due to improper input validation while handling the incoming CoAP message |
CVE-2022-25740 | Critical | 9.8 | 2023-04-13 | Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of the iface |
CVE-2022-25739 | High | 7.5 | 2023-04-13 | Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call |
CVE-2022-25737 | High | 7.5 | 2023-04-13 | Information disclosure in modem due to missing NULL check while reading packets received from local network |
CVE-2022-25731 | High | 7.5 | 2023-04-13 | Information disclosure in modem due to buffer over-read while processing packets from DNS server |
CVE-2022-25730 | High | 8.2 | 2023-04-13 | Information disclosure in modem due to improper check of IP type while processing DNS server query |
CVE-2022-25726 | High | 8.2 | 2023-04-13 | Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet |
CVE-2022-25678 | Critical | 9.8 | 2023-04-13 | Memory correction in modem due to buffer overwrite during coap connection |
CVE-2022-47605 | Medium | 6.4 | 2023-04-12 | Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions. |
CVE-2022-47053 | Medium | 5.4 | 2023-04-12 | An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code… |
CVE-2022-24350 | Medium | 5.5 | 2023-04-12 | An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the comman… |
CVE-2022-48437 | Medium | 5.3 | 2023-04-12 | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors t… |
CVE-2022-46396 | Low | 3.3 | 2023-04-11 | An issue was discovered in the Arm Mali Kernel Driver. A non-privileged user can make improper GPU memory processing operations to access a limited amount outs… |
CVE-2022-43955 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versio… |
CVE-2022-43952 | Low | 3.5 | 2023-04-11 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0… |
CVE-2022-43951 | Medium | 5.3 | 2023-04-11 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and… |
CVE-2022-43948 | Medium | 6.7 | 2023-04-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version… |
CVE-2022-43947 | Medium | 5.0 | 2023-04-11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiPr… |
CVE-2022-43946 | High | 7.5 | 2023-04-11 | Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) ra… |
CVE-2022-42477 | High | 7.1 | 2023-04-11 | An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authentica… |
CVE-2022-42470 | High | 7.8 | 2023-04-11 | A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to… |
CVE-2022-42469 | Medium | 4.3 | 2023-04-11 | A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an a… |
CVE-2022-41331 | Critical | 9.8 | 2023-04-11 | A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthentic… |
CVE-2022-41330 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3… |
CVE-2022-40682 | High | 7.8 | 2023-04-11 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauth… |
CVE-2022-40679 | High | 7.8 | 2023-04-11 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6… |
CVE-2022-35850 | Medium | 4.3 | 2023-04-11 | An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6… |
CVE-2022-27487 | High | 8.8 | 2023-04-11 | A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0… |
CVE-2022-27485 | Medium | 6.5 | 2023-04-11 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 thr… |
CVE-2022-43770 | Medium | 5.4 | 2023-04-11 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashb… |
CVE-2022-3695 | Medium | 6.5 | 2023-04-11 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard whe… |
CVE-2022-47468 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47467 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47466 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47465 | Medium | 5.5 | 2023-04-11 | In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service. |
CVE-2022-47464 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47463 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47362 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47338 | High | 7.1 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47337 | Medium | 5.5 | 2023-04-11 | In media service, there is a missing permission check. This could lead to local denial of service in media service. |
CVE-2022-47336 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47335 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-43768 | High | 7.5 | 2023-04-11 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions… |
CVE-2022-43767 | High | 7.5 | 2023-04-11 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions… |
CVE-2022-43716 | High | 7.5 | 2023-04-11 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions… |
CVE-2022-43293 | Medium | 5.9 | 2023-04-11 | Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \Wacom\Wacom_Tablet.exe. |
CVE-2022-38604 | High | 7.3 | 2023-04-11 | Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability. |
CVE-2022-46717 | Low | 2.4 | 2023-04-10 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch ma… |
CVE-2022-46716 | High | 7.5 | 2023-04-10 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality di… |
CVE-2022-46709 | Critical | 9.8 | 2023-04-10 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16. An app may be able to execute arbitrar… |
CVE-2022-46703 | Medium | 5.5 | 2023-04-10 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An a… |
CVE-2022-42858 | High | 7.8 | 2023-04-10 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code… |
CVE-2022-32871 | Low | 2.4 | 2023-04-10 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16. A person with physical access to a device may be able to use Siri to acc… |
CVE-2022-41976 | Critical | 9.9 | 2023-04-10 | An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privilege… |
CVE-2022-4827 | Medium | 5.4 | 2023-04-10 | The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |