2022 CVEs (page 49)
Page 49 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4492 | High | 7.5 | 2023-02-23 | The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should… |
CVE-2022-46786 | Medium | 5.4 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2). |
CVE-2022-3219 | Low | 3.3 | 2023-02-23 | GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a f… |
CVE-2022-48344 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. |
CVE-2022-48343 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. |
CVE-2022-48342 | Medium | 5.2 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
CVE-2022-2504 | Critical | 9.8 | 2023-02-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection. Thi… |
CVE-2022-48341 | High | 8.8 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator… |
CVE-2022-48149 | Critical | 9.8 | 2023-02-22 | Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-45600 | High | 8.8 | 2023-02-22 | Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunis… |
CVE-2022-45599 | Critical | 9.8 | 2023-02-22 | Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privil… |
CVE-2022-39983 | Critical | 9.8 | 2023-02-22 | File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbitrary code. |
CVE-2022-29273 | Medium | 6.1 | 2023-02-22 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. |
CVE-2022-43873 | Medium | 6.3 | 2023-02-22 | An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute code and escalate their privilege on the… |
CVE-2022-43870 | Medium | 6.5 | 2023-02-22 | IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540. |
CVE-2022-43578 | Medium | 4.6 | 2023-02-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2022-41567 | High | 7.3 | 2023-02-22 | The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attac… |
CVE-2022-41566 | High | 8.7 | 2023-02-22 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network… |
CVE-2022-41565 | High | 8.7 | 2023-02-22 | The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vuln… |
CVE-2022-41217 | Critical | 9.8 | 2023-02-22 | Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE b… |
CVE-2022-41216 | High | 8.3 | 2023-02-22 | Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system. |
CVE-2022-2883 | High | 7.5 | 2023-02-22 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2022-38779 | Medium | 6.1 | 2023-02-22 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2022-46637 | Critical | 9.8 | 2023-02-21 | Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services. |
CVE-2022-48282 | Medium | 6.6 | 2023-02-21 | Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause… |
CVE-2022-45677 | Critical | 9.8 | 2023-02-21 | SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php. |
CVE-2022-45564 | Critical | 9.8 | 2023-02-21 | SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql commands via the userCod… |
CVE-2022-3353 | Medium | 5.9 | 2023-02-21 | A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the vulnerability by… |
CVE-2022-31394 | High | 7.5 | 2023-02-21 | Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform… |
CVE-2022-4897 | Medium | 6.1 | 2023-02-21 | The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected… |
CVE-2022-4791 | Medium | 5.4 | 2023-02-21 | The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which c… |
CVE-2022-4786 | Medium | 5.4 | 2023-02-21 | The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2022-4785 | Medium | 5.4 | 2023-02-21 | The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2022-4784 | Medium | 5.4 | 2023-02-21 | The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4777 | Medium | 5.4 | 2023-02-21 | The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2022-4764 | Medium | 5.4 | 2023-02-21 | The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2022-4761 | Medium | 5.4 | 2023-02-21 | The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh… |
CVE-2022-4754 | Medium | 5.4 | 2023-02-21 | The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2022-4752 | Medium | 5.4 | 2023-02-21 | The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4750 | Medium | 5.4 | 2023-02-21 | The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting t… |
CVE-2022-4714 | Medium | 5.4 | 2023-02-21 | The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as cont… |
CVE-2022-4669 | Medium | 5.4 | 2023-02-21 | The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2022-4666 | Medium | 5.4 | 2023-02-21 | The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting th… |
CVE-2022-4622 | Medium | 5.4 | 2023-02-21 | The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2022-4386 | Medium | 4.3 | 2023-02-21 | The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any use… |
CVE-2022-4385 | Medium | 4.3 | 2023-02-21 | The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in use… |
CVE-2022-48340 | High | 7.5 | 2023-02-21 | In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free. |
CVE-2022-48339 | High | 7.8 | 2023-02-20 | An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file… |
CVE-2022-48338 | High | 7.3 | 2023-02-20 | An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-f… |
CVE-2022-48337 | Critical | 9.8 | 2023-02-20 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-44216 | High | 7.5 | 2023-02-20 | Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password. |
CVE-2022-3901 | High | 7.2 | 2023-02-20 | Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system. |
CVE-2022-48321 | Medium | 6.8 | 2023-02-20 | Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted e… |
CVE-2022-48320 | Medium | 5.4 | 2023-02-20 | Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new v… |
CVE-2022-48319 | Medium | 6.5 | 2023-02-20 | Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) all… |
CVE-2022-48318 | Medium | 5.3 | 2023-02-20 | No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information discl… |
CVE-2022-48317 | Medium | 5.6 | 2023-02-20 | Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired sess… |
CVE-2022-47909 | Medium | 6.8 | 2023-02-20 | Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk… |
CVE-2022-46836 | Critical | 9.1 | 2023-02-20 | PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to in… |
CVE-2022-46303 | High | 8.0 | 2023-02-20 | Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management per… |
CVE-2022-48329 | Critical | 9.8 | 2023-02-20 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php… |
CVE-2022-48328 | Critical | 9.8 | 2023-02-20 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. |
CVE-2022-40348 | Medium | 5.4 | 2023-02-18 | Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, allows attackers to ex… |
CVE-2022-48115 | Medium | 6.1 | 2023-02-17 | The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS). |
CVE-2022-40021 | Critical | 9.8 | 2023-02-17 | QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability. |
CVE-2022-43579 | Medium | 4.6 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2022-40231 | Medium | 4.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized acti… |
CVE-2022-34351 | Medium | 5.9 | 2023-02-17 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data… |
CVE-2022-43930 | Medium | 6.2 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IB… |
CVE-2022-41734 | Medium | 5.3 | 2023-02-17 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-40232 | Medium | 6.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have ac… |
CVE-2022-20803 | High | 8.6 | 2023-02-17 | A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a… |
CVE-2022-43929 | Medium | 4.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID… |
CVE-2022-43927 | Medium | 5.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted… |
CVE-2022-36775 | Medium | 6.5 | 2023-02-17 | IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input b… |
CVE-2022-47986 | Critical | 9.8 | 2023-02-17 | IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw… |
CVE-2022-45701 | High | 8.8 | 2023-02-17 | Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. |
CVE-2022-40032 | Critical | 9.8 | 2023-02-17 | SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitr… |
CVE-2022-32972 | High | 7.8 | 2023-02-17 | Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. |
CVE-2022-40347 | Critical | 9.8 | 2023-02-17 | SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attacke… |
CVE-2022-47703 | High | 7.5 | 2023-02-16 | TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version… |
CVE-2022-44299 | Medium | 4.9 | 2023-02-16 | SiteServerCMS 7.1.3 sscms has a file read vulnerability. |
CVE-2022-0637 | Medium | 6.1 | 2023-02-16 | open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6 |
CVE-2022-48327 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicia… |
CVE-2022-48326 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2)… |
CVE-2022-48325 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2)… |
CVE-2022-48324 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa… |
CVE-2022-41614 | Medium | 5.5 | 2023-02-16 | Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enab… |
CVE-2022-41314 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-38090 | Medium | 6.0 | 2023-02-16 | Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially ena… |
CVE-2022-38056 | Low | 3.8 | 2023-02-16 | Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via netwo… |
CVE-2022-37340 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privil… |
CVE-2022-36797 | Low | 3.3 | 2023-02-16 | Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to poten… |
CVE-2022-36416 | Medium | 4.4 | 2023-02-16 | Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to pote… |
CVE-2022-36397 | High | 7.3 | 2023-02-16 | Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentia… |
CVE-2022-36382 | Medium | 6.0 | 2023-02-16 | Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Intel(R) Ethernet 700 S… |
CVE-2022-36369 | High | 7.8 | 2023-02-16 | Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially enable escalation of… |
CVE-2022-36289 | Low | 2.8 | 2023-02-16 | Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service v… |
CVE-2022-36287 | Medium | 4.0 | 2023-02-16 | Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable denial of service v… |
CVE-2022-35883 | Low | 2.2 | 2023-02-16 | NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via l… |