2022 CVEs (page 53)
Page 53 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44566 | High | 7.5 | 2023-02-09 | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer… |
CVE-2022-43552 | Medium | 5.9 | 2023-02-09 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies ca… |
CVE-2022-43550 | Critical | 9.8 | 2023-02-09 | A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow a… |
CVE-2022-48302 | High | 7.5 | 2023-02-09 | The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48301 | High | 7.5 | 2023-02-09 | The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that… |
CVE-2022-48300 | High | 7.5 | 2023-02-09 | The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48299 | High | 7.5 | 2023-02-09 | The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48298 | High | 7.5 | 2023-02-09 | The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access. |
CVE-2022-48297 | High | 7.5 | 2023-02-09 | The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bo… |
CVE-2022-48296 | Medium | 5.3 | 2023-02-09 | The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasts from malicious a… |
CVE-2022-48295 | High | 7.5 | 2023-02-09 | The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of… |
CVE-2022-48294 | High | 7.5 | 2023-02-09 | The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48293 | Medium | 6.5 | 2023-02-09 | The Bluetooth module has an OOM vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48292 | Medium | 6.5 | 2023-02-09 | The Bluetooth module has an out-of-memory (OOM) vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48290 | Critical | 9.1 | 2023-02-09 | The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity. |
CVE-2022-48289 | High | 7.5 | 2023-02-09 | The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidenti… |
CVE-2022-48288 | High | 7.5 | 2023-02-09 | The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidenti… |
CVE-2022-48287 | High | 7.5 | 2023-02-09 | The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data integrity. |
CVE-2022-48286 | High | 7.5 | 2023-02-09 | The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-30564 | Medium | 5.3 | 2023-02-09 | Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable… |
CVE-2022-43440 | High | 8.8 | 2023-02-09 | Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site us… |
CVE-2022-47648 | High | 7.6 | 2023-02-08 | An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authenticati… |
CVE-2022-45982 | Critical | 9.8 | 2023-02-08 | thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted pay… |
CVE-2022-38778 | Medium | 6.5 | 2023-02-08 | A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes th… |
CVE-2022-38777 | High | 7.8 | 2023-02-08 | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to t… |
CVE-2022-4450 | High | 7.5 | 2023-02-08 | The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the… |
CVE-2022-4304 | Medium | 5.9 | 2023-02-08 | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichen… |
CVE-2022-34350 | Medium | 5.3 | 2023-02-08 | IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack… |
CVE-2022-45755 | Medium | 5.4 | 2023-02-08 | Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information pa… |
CVE-2022-45527 | Critical | 9.8 | 2023-02-08 | File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malicious files to the c… |
CVE-2022-45526 | Critical | 9.8 | 2023-02-08 | SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to… |
CVE-2022-42438 | High | 7.5 | 2023-02-08 | IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM… |
CVE-2022-35720 | Low | 2.3 | 2023-02-08 | IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation th… |
CVE-2022-34362 | Medium | 4.6 | 2023-02-08 | IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attack… |
CVE-2022-41620 | Medium | 5.4 | 2023-02-08 | Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions. |
CVE-2022-43765 | High | 7.5 | 2023-02-08 | B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to c… |
CVE-2022-43764 | Critical | 9.8 | 2023-02-08 | Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This… |
CVE-2022-43763 | High | 7.5 | 2023-02-08 | Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07. … |
CVE-2022-43762 | High | 7.5 | 2023-02-08 | Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages |
CVE-2022-43761 | Critical | 9.4 | 2023-02-08 | Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration. … |
CVE-2022-2094 | Medium | 6.1 | 2023-02-08 | The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross… |
CVE-2022-45192 | Medium | 6.5 | 2023-02-08 | An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a cleartext encryption pa… |
CVE-2022-45191 | Medium | 6.5 | 2023-02-08 | An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pair confirm message wi… |
CVE-2022-45190 | Medium | 5.3 | 2023-02-08 | An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry in the legacy pairing of the device. |
CVE-2022-40480 | Medium | 6.5 | 2023-02-08 | Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via… |
CVE-2022-47418 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document ver… |
CVE-2022-47419 | Medium | 5.4 | 2023-02-07 | An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system. |
CVE-2022-47417 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document fil… |
CVE-2022-47416 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app chat system. |
CVE-2022-47415 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messa… |
CVE-2022-47414 | Medium | 5.4 | 2023-02-07 | If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality. |
CVE-2022-47413 | Medium | 5.4 | 2023-02-07 | Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition. |
CVE-2022-46663 | High | 7.5 | 2023-02-07 | In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. |
CVE-2022-45768 | High | 8.8 | 2023-02-07 | Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker to execute arbitrary code via the formW… |
CVE-2022-47412 | Medium | 5.4 | 2023-02-07 | Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS… |
CVE-2022-4883 | High | 8.8 | 2023-02-07 | A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on t… |
CVE-2022-46285 | High | 7.5 | 2023-02-07 | A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infi… |
CVE-2022-24990 | High | 7.5 | 2023-02-07 | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNa… |
CVE-2022-41313 | Medium | 5.4 | 2023-02-07 | A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-cra… |
CVE-2022-41312 | Medium | 5.4 | 2023-02-07 | A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-cra… |
CVE-2022-41311 | Medium | 5.4 | 2023-02-07 | A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-cra… |
CVE-2022-40693 | High | 7.5 | 2023-02-07 | A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted… |
CVE-2022-40691 | Medium | 5.3 | 2023-02-07 | An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted… |
CVE-2022-40224 | High | 7.5 | 2023-02-07 | A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP messa… |
CVE-2022-45544 | High | 8.8 | 2023-02-07 | Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao par… |
CVE-2022-43759 | High | 7.2 | 2023-02-07 | A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted… |
CVE-2022-43758 | High | 7.6 | 2023-02-07 | A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with… |
CVE-2022-43757 | Critical | 9.9 | 2023-02-07 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends o… |
CVE-2022-43756 | Medium | 5.9 | 2023-02-07 | A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to c… |
CVE-2022-43755 | High | 7.1 | 2023-02-07 | A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token w… |
CVE-2022-31249 | High | 7.5 | 2023-02-07 | A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers… |
CVE-2022-21953 | High | 7.4 | 2023-02-07 | A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster… |
CVE-2022-21948 | Medium | 4.3 | 2023-02-07 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into… |
CVE-2022-31254 | High | 7.8 | 2023-02-07 | A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP… |
CVE-2022-42291 | High | 8.2 | 2023-02-07 | NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete d… |
CVE-2022-31611 | Medium | 6.8 | 2023-02-07 | NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may ca… |
CVE-2022-45854 | Medium | 4.3 | 2023-02-07 | An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary den… |
CVE-2022-45441 | Medium | 6.1 | 2023-02-07 | A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious s… |
CVE-2022-38547 | High | 7.2 | 2023-02-07 | A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware ve… |
CVE-2022-46496 | Medium | 5.9 | 2023-02-06 | BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate. |
CVE-2022-44617 | High | 7.5 | 2023-02-06 | A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an… |
CVE-2022-3229 | Critical | 9.8 | 2023-02-06 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker ca… |
CVE-2022-28923 | Medium | 6.1 | 2023-02-06 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. |
CVE-2022-48166 | High | 7.5 | 2023-02-06 | An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain adm… |
CVE-2022-48311 | Critical | 9.0 | 2023-02-06 | **UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows… |
CVE-2022-45589 | High | 7.2 | 2023-02-06 | All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning s… |
CVE-2022-44268 | Medium | 6.5 | 2023-02-06 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the conten… |
CVE-2022-44267 | Medium | 6.5 | 2023-02-06 | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin inp… |
CVE-2022-42951 | High | 8.1 | 2023-02-06 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server n… |
CVE-2022-42950 | Medium | 4.9 | 2023-02-06 | An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase… |
CVE-2022-42439 | Medium | 6.8 | 2023-02-06 | IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which… |
CVE-2022-4838 | Medium | 5.4 | 2023-02-06 | The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which cou… |
CVE-2022-4836 | Medium | 5.4 | 2023-02-06 | The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4833 | Medium | 5.4 | 2023-02-06 | The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before out… |
CVE-2022-4826 | Medium | 5.4 | 2023-02-06 | The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2022-4825 | Medium | 5.4 | 2023-02-06 | The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2022-4824 | Medium | 5.4 | 2023-02-06 | The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4762 | Medium | 5.4 | 2023-02-06 | The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4756 | Medium | 5.4 | 2023-02-06 | The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4747 | Medium | 5.4 | 2023-02-06 | The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them… |