2022 CVEs (page 48)
Page 48 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47076 | High | 7.5 | 2023-02-28 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx. |
CVE-2022-47075 | High | 7.5 | 2023-02-28 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmploye… |
CVE-2022-23240 | Medium | 6.5 | 2023-02-28 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorize… |
CVE-2022-23239 | Medium | 4.8 | 2023-02-28 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows administrat… |
CVE-2022-41727 | Medium | 5.5 | 2023-02-28 | An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of serv… |
CVE-2022-41725 | High | 7.5 | 2023-02-28 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm… |
CVE-2022-41724 | High | 7.5 | 2023-02-28 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respecti… |
CVE-2022-41723 | High | 7.5 | 2023-02-28 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of… |
CVE-2022-41722 | High | 7.5 | 2023-02-28 | A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b"… |
CVE-2022-20551 | Medium | 6.7 | 2023-02-28 | In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code. This could lead to lo… |
CVE-2022-20481 | Medium | 5.5 | 2023-02-28 | In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local information disclosure with n… |
CVE-2022-20455 | Medium | 5.5 | 2023-02-28 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of s… |
CVE-2022-47612 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update. |
CVE-2022-47179 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft. |
CVE-2022-43459 | Medium | 5.4 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. |
CVE-2022-4895 | High | 8.6 | 2023-02-28 | Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on… |
CVE-2022-3884 | High | 7.3 | 2023-02-28 | Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to… |
CVE-2022-46723 | Critical | 9.8 | 2023-02-27 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A remote user may be able to write arbitrary… |
CVE-2022-46713 | Medium | 4.7 | 2023-02-27 | A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be… |
CVE-2022-46712 | High | 7.8 | 2023-02-27 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13. An app may be able to cause unexpected system te… |
CVE-2022-46705 | Medium | 4.3 | 2023-02-27 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, mac… |
CVE-2022-46704 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may… |
CVE-2022-42838 | Low | 3.3 | 2023-02-27 | An issue with app access to camera data was addressed with improved logic. This issue is fixed in macOS Ventura 13. A camera extension may be able to continue… |
CVE-2022-42833 | High | 7.8 | 2023-02-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with… |
CVE-2022-42826 | High | 8.8 | 2023-02-27 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing… |
CVE-2022-42797 | High | 7.8 | 2023-02-27 | An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges. |
CVE-2022-32949 | High | 7.8 | 2023-02-27 | This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16. An app may be able to execute arbitrary code with… |
CVE-2022-32906 | Medium | 5.3 | 2023-02-27 | This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privile… |
CVE-2022-32902 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6, macOS Big Sur 11.7. An app may be abl… |
CVE-2022-32900 | High | 7.8 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. An app may be able to gain elevated… |
CVE-2022-32896 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. A user may be able to view sensitive use… |
CVE-2022-32891 | Medium | 6.1 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious conte… |
CVE-2022-32855 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6. A user may be able to view restricted content from… |
CVE-2022-32846 | High | 7.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive… |
CVE-2022-32844 | Medium | 6.3 | 2023-02-27 | A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app with arbitrary ker… |
CVE-2022-32836 | High | 7.5 | 2023-02-27 | This issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive dat… |
CVE-2022-32830 | High | 7.5 | 2023-02-27 | An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.6, iOS 15.6 and iPadOS 15.6. Processing a maliciously c… |
CVE-2022-32824 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose… |
CVE-2022-32784 | Medium | 6.5 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may lea… |
CVE-2022-26760 | Critical | 9.8 | 2023-02-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 15.5 and iPadOS 15.5. A malicious application may be able to… |
CVE-2022-22668 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A malicious application may be ab… |
CVE-2022-22582 | Medium | 5.5 | 2023-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2… |
CVE-2022-48305 | Medium | 5.5 | 2023-02-27 | There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability m… |
CVE-2022-48284 | Critical | 9.8 | 2023-02-27 | A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could all… |
CVE-2022-48283 | Critical | 9.8 | 2023-02-27 | A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could all… |
CVE-2022-48261 | High | 7.5 | 2023-02-27 | There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to… |
CVE-2022-48260 | High | 7.5 | 2023-02-27 | There is a buffer overflow vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to device service exceptions. |
CVE-2022-48259 | Critical | 9.8 | 2023-02-27 | There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges. |
CVE-2022-48255 | Critical | 9.8 | 2023-02-27 | There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploi… |
CVE-2022-48254 | Medium | 4.6 | 2023-02-27 | There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication. |
CVE-2022-48230 | High | 7.5 | 2023-02-27 | There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS. |
CVE-2022-4829 | Medium | 5.4 | 2023-02-27 | The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2022-4795 | Medium | 5.4 | 2023-02-27 | The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/… |
CVE-2022-4788 | Medium | 5.4 | 2023-02-27 | The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2022-4757 | Medium | 5.4 | 2023-02-27 | The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-4679 | Medium | 5.4 | 2023-02-27 | The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4550 | High | 7.5 | 2023-02-27 | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP s… |
CVE-2022-45697 | High | 7.8 | 2023-02-27 | Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory. |
CVE-2022-45140 | Critical | 9.8 | 2023-02-27 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remot… |
CVE-2022-45139 | Medium | 5.3 | 2023-02-27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combina… |
CVE-2022-45138 | Critical | 9.8 | 2023-02-27 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. Th… |
CVE-2022-45137 | Medium | 6.1 | 2023-02-27 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads… |
CVE-2022-40237 | Medium | 6.5 | 2023-02-27 | IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization logic. IBM X-Force ID: 2… |
CVE-2022-34910 | Medium | 4.1 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password i… |
CVE-2022-34909 | High | 7.7 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and… |
CVE-2022-34908 | High | 8.2 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not requ… |
CVE-2022-31405 | Medium | 6.5 | 2023-02-27 | MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext. |
CVE-2022-48363 | High | 7.5 | 2023-02-26 | In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving… |
CVE-2022-48362 | High | 8.8 | 2023-02-25 | Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, aut… |
CVE-2022-2024 | Critical | 9.8 | 2023-02-25 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. |
CVE-2022-23535 | High | 7.3 | 2023-02-24 | LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a… |
CVE-2022-44310 | High | 7.5 | 2023-02-24 | In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret. |
CVE-2022-4203 | Medium | 4.9 | 2023-02-24 | A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate cha… |
CVE-2022-43923 | Medium | 6.2 | 2023-02-24 | IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. IBM X-Force ID: 241584. |
CVE-2022-48345 | Medium | 6.1 | 2023-02-24 | sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities. |
CVE-2022-1607 | Medium | 4.6 | 2023-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.Thi… |
CVE-2022-46440 | Medium | 5.5 | 2023-02-24 | ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c. |
CVE-2022-46785 | Medium | 6.1 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2). |
CVE-2022-46784 | Medium | 6.1 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.) |
CVE-2022-36231 | Critical | 9.8 | 2023-02-23 | pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3. |
CVE-2022-4492 | High | 7.5 | 2023-02-23 | The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should… |
CVE-2022-46786 | Medium | 5.4 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2). |
CVE-2022-3219 | Low | 3.3 | 2023-02-23 | GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a f… |
CVE-2022-48344 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. |
CVE-2022-48343 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. |
CVE-2022-48342 | Medium | 5.2 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
CVE-2022-2504 | Critical | 9.8 | 2023-02-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection. Thi… |
CVE-2022-48341 | High | 8.8 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator… |
CVE-2022-48149 | Critical | 9.8 | 2023-02-22 | Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-45600 | High | 8.8 | 2023-02-22 | Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunis… |
CVE-2022-45599 | Critical | 9.8 | 2023-02-22 | Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privil… |
CVE-2022-39983 | Critical | 9.8 | 2023-02-22 | File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbitrary code. |
CVE-2022-29273 | Medium | 6.1 | 2023-02-22 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. |
CVE-2022-43873 | Medium | 6.3 | 2023-02-22 | An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute code and escalate their privilege on the… |
CVE-2022-43870 | Medium | 6.5 | 2023-02-22 | IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540. |
CVE-2022-43578 | Medium | 4.6 | 2023-02-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2022-41567 | High | 7.3 | 2023-02-22 | The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attac… |
CVE-2022-41566 | High | 8.7 | 2023-02-22 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network… |
CVE-2022-41565 | High | 8.7 | 2023-02-22 | The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vuln… |
CVE-2022-41217 | Critical | 9.8 | 2023-02-22 | Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE b… |