2022 CVEs (page 55)
Page 55 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47717 | High | 7.5 | 2023-02-01 | Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS). |
CVE-2022-47715 | Medium | 5.3 | 2023-02-01 | In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic. |
CVE-2022-47714 | Critical | 9.8 | 2023-02-01 | Last Yard 22.09.8-1 does not enforce HSTS headers |
CVE-2022-47003 | Critical | 9.8 | 2023-02-01 | A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request. |
CVE-2022-47002 | Critical | 9.8 | 2023-02-01 | A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request. |
CVE-2022-3990 | High | 7.8 | 2023-02-01 | HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates shoul… |
CVE-2022-27538 | High | 7.0 | 2023-02-01 | A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execu… |
CVE-2022-27537 | High | 7.8 | 2023-02-01 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privileg… |
CVE-2022-23455 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-23454 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-23453 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-46756 | High | 8.2 | 2023-02-01 | Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerabilit… |
CVE-2022-46679 | Medium | 6.5 | 2023-02-01 | Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. A remote unauthenticated attacker could potentially explo… |
CVE-2022-45102 | Medium | 5.4 | 2023-02-01 | Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote unauthenticated attacker may potentiall… |
CVE-2022-45100 | High | 8.1 | 2023-02-01 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unauthenticated attacker could potentially e… |
CVE-2022-45099 | High | 7.8 | 2023-02-01 | Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit… |
CVE-2022-45098 | Medium | 6.1 | 2023-02-01 | Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. An authenticated local attacker co… |
CVE-2022-34403 | High | 7.5 | 2023-02-01 | Dell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to… |
CVE-2022-34398 | High | 7.5 | 2023-02-01 | Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using… |
CVE-2022-34396 | High | 7.0 | 2023-02-01 | Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker… |
CVE-2022-32482 | Medium | 5.6 | 2023-02-01 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnera… |
CVE-2022-45101 | High | 7.3 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS. A remote unauthenticated attacker coul… |
CVE-2022-45097 | Medium | 6.3 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network attacker could potentially exploit this vu… |
CVE-2022-45096 | Medium | 5.4 | 2023-02-01 | Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An unauthenticated remote user could unintentionally lead an administrat… |
CVE-2022-45095 | Medium | 6.7 | 2023-02-01 | Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access local shell and having the privilege to gat… |
CVE-2022-34459 | High | 7.8 | 2023-02-01 | Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable dr… |
CVE-2022-34458 | Medium | 6.6 | 2023-02-01 | Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System Information to an Unauthorized Control S… |
CVE-2022-34443 | High | 7.8 | 2023-02-01 | Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. A Local Low Privilege attacker could potentia… |
CVE-2022-34400 | High | 7.1 | 2023-02-01 | Dell BIOS contains a heap buffer overflow vulnerability. A local attacker with admin privileges could potentially exploit this vulnerability to perform an arb… |
CVE-2022-25916 | High | 7.4 | 2023-02-01 | Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. |
CVE-2022-25906 | High | 7.4 | 2023-02-01 | All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the… |
CVE-2022-4062 | High | 7.8 | 2023-02-01 | A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to local… |
CVE-2022-42973 | High | 7.8 | 2023-02-01 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affecte… |
CVE-2022-42972 | High | 7.8 | 2023-02-01 | A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifie… |
CVE-2022-42971 | Critical | 9.8 | 2023-02-01 | A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JS… |
CVE-2022-42970 | Critical | 9.8 | 2023-02-01 | A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identi… |
CVE-2022-2329 | Critical | 9.8 | 2023-02-01 | A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote… |
CVE-2022-24324 | Critical | 9.8 | 2023-02-01 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code ex… |
CVE-2022-4206 | Medium | 5.0 | 2023-02-01 | A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in t… |
CVE-2022-47770 | Critical | 9.8 | 2023-02-01 | Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection. |
CVE-2022-47769 | Critical | 9.8 | 2023-02-01 | An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root o… |
CVE-2022-47768 | High | 7.5 | 2023-02-01 | Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal. |
CVE-2022-31902 | Medium | 5.5 | 2023-02-01 | Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). |
CVE-2022-48161 | High | 7.5 | 2023-02-01 | Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited vi… |
CVE-2022-47873 | Critical | 9.8 | 2023-01-31 | Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote). |
CVE-2022-45494 | High | 7.8 | 2023-01-31 | Buffer overflow vulnerability in function json_parse_object in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-45297 | Critical | 9.8 | 2023-01-31 | EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter. |
CVE-2022-32984 | High | 7.5 | 2023-01-31 | BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive informatio… |
CVE-2022-47854 | Critical | 9.8 | 2023-01-31 | i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php. |
CVE-2022-47701 | Medium | 6.1 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-47700 | High | 7.5 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Imprope… |
CVE-2022-47699 | Critical | 9.8 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control. |
CVE-2022-47698 | Medium | 6.1 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS) via the URL filte… |
CVE-2022-47697 | Critical | 9.8 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeover. Anyone can rese… |
CVE-2022-45172 | Critical | 9.8 | 2023-01-31 | An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the… |
CVE-2022-47780 | Critical | 9.8 | 2023-01-31 | SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter. |
CVE-2022-47035 | Critical | 9.8 | 2023-01-31 | Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /C… |
CVE-2022-45598 | Medium | 6.1 | 2023-01-31 | Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization. |
CVE-2022-28331 | Critical | 9.8 | 2023-01-31 | On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overf… |
CVE-2022-25147 | Medium | 6.5 | 2023-01-31 | Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of… |
CVE-2022-24963 | Critical | 9.8 | 2023-01-31 | Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. Th… |
CVE-2022-46835 | High | 8.8 | 2023-01-31 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2022-45435 | Medium | 6.8 | 2023-01-31 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2022-44645 | High | 8.8 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-44644 | Medium | 6.5 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecti… |
CVE-2022-39061 | Medium | 6.5 | 2023-01-31 | ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated r… |
CVE-2022-39060 | Critical | 9.8 | 2023-01-31 | ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability… |
CVE-2022-39059 | High | 7.5 | 2023-01-31 | ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit… |
CVE-2022-45789 | High | 8.1 | 2023-01-31 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hija… |
CVE-2022-25979 | Medium | 5.4 | 2023-01-31 | Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function. |
CVE-2022-25881 | Medium | 5.3 | 2023-01-31 | This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when t… |
CVE-2022-21129 | High | 7.4 | 2023-01-31 | Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function… |
CVE-2022-4898 | Medium | 5.4 | 2023-01-31 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially res… |
CVE-2022-4441 | High | 7.6 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-4041 | Medium | 5.9 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-44897 | Medium | 6.1 | 2023-01-31 | A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2022-40258 | Medium | 5.3 | 2023-01-31 | AMI Megarac Weak password hashes for Redfish & API |
CVE-2022-30421 | High | 7.8 | 2023-01-31 | Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) passw… |
CVE-2022-48176 | High | 7.8 | 2023-01-31 | Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authe… |
CVE-2022-45897 | Medium | 6.5 | 2023-01-31 | On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials asso… |
CVE-2022-48175 | Critical | 9.8 | 2023-01-30 | Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. |
CVE-2022-32748 | High | 7.9 | 2023-01-30 | A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure d… |
CVE-2022-32747 | High | 8.0 | 2023-01-30 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account… |
CVE-2022-32529 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32528 | High | 8.6 | 2023-01-30 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project… |
CVE-2022-32527 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32526 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32525 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32524 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32523 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32522 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32521 | High | 7.1 | 2023-01-30 | A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data i… |
CVE-2022-32520 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32519 | High | 8.0 | 2023-01-30 | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network… |
CVE-2022-32518 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32517 | Medium | 6.5 | 2023-01-30 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into inte… |
CVE-2022-32516 | High | 7.5 | 2023-01-30 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product su… |
CVE-2022-32515 | High | 8.6 | 2023-01-30 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account w… |
CVE-2022-32514 | Critical | 9.8 | 2023-01-30 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Produ… |
CVE-2022-32513 | Critical | 9.8 | 2023-01-30 | A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the passwo… |